TF-MAL-elf.facefish
📛 Threat Title
Malware family: Facefish
Description
ThreatFox malware family `elf.facefish`. Printable name: Facefish.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.facefish
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.facefish
IOC database
- Type
- domain
- Value
elf.facefish- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.facefish
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.facefish
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:alpha-cyber.com
Beyond the Surface: Mapping the Facefish Rootkit's Digital Footprint In the shadowy world of cyber threats, some malware aims not just to steal data, but to disappear. Rootkits like Facefish are designed precisely for this: to hide their presence and maintain stealthy, persistent control over compromised Linux systems, often to steal valuable SSH credentials for […]
-
web:blog.netlab.360.com
Overview Facefish consists of 2 parts, Dropper and Rootkit, and its main function is determined by the Rootkit module, which works at the Ring3 layer and is loaded using the LD_PRELOAD feature to steal user login credentials by hooking ssh/sshd program related functions, and it also supports some backdoor functions.
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:hivepro.com
Their arsenal of malware includes ShadowPad, a modular backdoor frequently used for persistent access; Spyder, an encrypted communication tool for post-compromise activities; and SodaMaster, a backdoor used for data extraction and remote command execution.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Facefish malware family including references, samples and yara signatures.
-
web:redcanary.com
Extended Berkeley Packet Filter (eBPF) is beginning to transform the Linux malware landscape. Here's what defenders should look out for.
-
web:sensorstechforum.com
The new Linux rootkit malware with backdoor functionalities was discovered by Qihoo 360 NETLAB security researchers who named its dropper Facefish .
-
web:www.broadcom.com
A Facefish story Symantec Security Response is aware of a new Linux malware labeled " Facefish ". Facefish is made up of dropper and rootkit parts, in which the rootkit portion dictates its main function. The malware was named after the polymorphic nature of the rootkit, like face-changing in Sichuan Opera, and the Blowfish cipher it employs to communicate with Command and Control servers (C&C ...
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.researchgate.net
Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.